[实验室日题][20201204][Misc]非常规进制转换 自定义编码分析 WriteUp

WriteUp

下载题目附件，得到一个带密码的压缩包，压缩包注释如下：

1152754738585
10进制?

尝试使用十进制数转字符串，得到乱码；尝试使用十进制数组转字符串，但是发现数据长度不是3的倍数，没法转。

于是猜测可能不是十进制，观察发现没有9字符，所以猜测是九进制，尝试使用九进制数转十六进制数组，得到4d616f4d75，转成字符串就是MaoMu，尝试解压得到001.png和2.zip。

打开2.zip，发现存在密码，压缩包注释为密码共10位，前几位在图片中，后面的为数字，所以图片必然存在隐写。

观察图片，拖入010发现没有异常，直接打开会提示文件损坏，于是猜测存在高度隐写，因为此题对于高度没有特殊要求，所以没必要按照pngcrc来还原高度，直接改大一点就完事。得到文本moonin。

打开ARCHPR，掩码moonin????，勾选数字字符，开始掩码爆破，得到密码moonin1919，解压得到the moon and sixpence.txt和说明.txt。

the moon and sixpence.txt

the moon and sixpence
i did not see him again for nearlY a week. then he fetched me soon after seven one evening and took me out to dinner. he was dressed in the deepest mourning, and on his bowler was a broad black band. he had even a black border to his handkerchieF. his garb of woe suggested that he had lost in one catastrophe every relation he had in the world, even to cousins by marriage twice removed. his plumpness and his red, fat cheeks maDe his mourning not a little incongruous. it was cruel that his extreme unhappiness should have in it something of buffoonery.
he told me he had made up his mind to go Away, though not to italy, as i had suggested, but to holland.
"i'm starting tO-morrow. this is perhaps the last time we shall ever meet."
I made an appropriate rejoinder, and he smiled wanly.
"i haven't been home for five years. i think i'd Forgotten it all; i seemed to have come so far away from my father's house that i was shy at the idea of revisiting it; but now i feel it's my only refuGe."
he was sore and bruised, and his thoughts went back to the tenderness of his mother's love. the ridicUle he had endured for years seemed now to weigh him down, and the final blow of blanche's treachery had robbed him of the resiliency which had made him take it so gaily. he could no longer laugh with those who laughed at him. he was an outcast. he told me of his childhood in the tidy brick house, aNd of his mother's passionate orderliness. her kitchen was a miracle of clean brightness. everything was always in its place, and no where could you see a speck of dust. cleanliness, indeed, was a mania with her. i saw a neat little old woman, with cheeks like apples, toiling away from morning to night, through the long years, to keep her house trim and spruce. his father was a spare old man, his hands gnarled after the work of a lifetime, silent and upright; in the evening he read the paper aLoud, while his wife and daughter (now married to the captain of a fishing smack), unwilling to lose a moment, bent over their sewing. nothing ever happened in that little town, left behind by the advance of civilisation, and one year followed the next till death came, like a friend, to give rest to those who had laboured so diligently.

说明.txt

将最终得到的字符串小写套上flag{}即为答案
注：最终答案是一串有意义的字符串

大致观察发现几乎都是可读明文，只有部分单词的拼写和大小写比较奇怪，于是复制到Word里进行拼写检查，发现标红的地方附件都存在大小写异常，于是猜测需要提取大写字符。

编写脚本提取大写字符。

dict = """the moon and sixpence
i did not see him again for nearlY a week. then he fetched me soon after seven one evening and took me out to dinner. he was dressed in the deepest mourning, and on his bowler was a broad black band. he had even a black border to his handkerchieF. his garb of woe suggested that he had lost in one catastrophe every relation he had in the world, even to cousins by marriage twice removed. his plumpness and his red, fat cheeks maDe his mourning not a little incongruous. it was cruel that his extreme unhappiness should have in it something of buffoonery.
he told me he had made up his mind to go Away, though not to italy, as i had suggested, but to holland.
"i'm starting tO-morrow. this is perhaps the last time we shall ever meet."
I made an appropriate rejoinder, and he smiled wanly.
"i haven't been home for five years. i think i'd Forgotten it all; i seemed to have come so far away from my father's house that i was shy at the idea of revisiting it; but now i feel it's my only refuGe."
he was sore and bruised, and his thoughts went back to the tenderness of his mother's love. the ridicUle he had endured for years seemed now to weigh him down, and the final blow of blanche's treachery had robbed him of the resiliency which had made him take it so gaily. he could no longer laugh with those who laughed at him. he was an outcast. he told me of his childhood in the tidy brick house, aNd of his mother's passionate orderliness. her kitchen was a miracle of clean brightness. everything was always in its place, and no where could you see a speck of dust. cleanliness, indeed, was a mania with her. i saw a neat little old woman, with cheeks like apples, toiling away from morning to night, through the long years, to keep her house trim and spruce. his father was a spare old man, his hands gnarled after the work of a lifetime, silent and upright; in the evening he read the paper aLoud, while his wife and daughter (now married to the captain of a fishing smack), unwilling to lose a moment, bent over their sewing. nothing ever happened in that little town, left behind by the advance of civilisation, and one year followed the next till death came, like a friend, to give rest to those who had laboured so diligently.
"""
enc = ""
for i in dict:
    if ord(i) in range(ord('A'), ord('Z') + 1):
        enc = enc + i
print(enc)

得到YFDAOIFGUNL，发现并不是可读明文，尝试进行栅栏密码和凯撒密码，都没有发现可读明文。

观察发现，将字符重新排列可得到FLAG、YOU、FIND三个单词，所以猜测flag应当就是flag{youfindflag}，但是似乎这个逻辑并不太严谨。

继续观察，发现YOU三个字符分别在1、5、9位置，那么可能存在类似约瑟夫环编码方式。那么尝试按照约瑟夫环的方式进行分析。

0. 初始字符串YFDAOIFGUNL
1. 第1次，Y出局，字符串变成 FDAOIFGUNL
2. 第2次，步长为4，O出局，字符串变成 FDA IFGUNL
3. 第3次，步长为4，U出局，字符串变成 FDA IFG NL
4. 第4次，步长为4，D出局，字符串变成 F A IFG NL

发现与我们推测的flag并不一样，那么可能步长有问题，若第4次需要出F，那么步长应当变为3，所以我们推断可能存在按周期自减的步长，于是继续推导。

4. 第4次，步长为3，F出局，字符串变成 DA IFG NL
5. 第5次，步长为3，I出局，字符串变成 DA FG NL
6. 第6次，步长为3，N出局，字符串变成 DA FG L
7. 第7次，步长为2，D出局，字符串变成 A FG L
8. 第8次，步长为2，F出局，字符串变成 A G L
9. 第9次，步长为2，L出局，字符串变成 A G
10. 第10次，步长为1，A出局，字符串变成 G
11. 第11次，步长为1，G出局，字符串变成

发现推测成立。

但实际上这个推测有一种漏洞，即在步入最后一个字符的下一个位置时，迈步正好结束，那么按理来说，步长应当减1，也是迈到最后一个字符就结束，但这又没进入新的周期，产生悖论...

所以得再找个更信服一点编码逻辑。

于是猜测使用类似于栅栏的逻辑，进行轮询提取字符。

这里使得分栏数为3，可将字符串近似均分为YFDA|OIFG|UNL，每次轮询提取每栏的首字符。

1. 第1轮得到YOU，栅栏中还剩FDA|IFG|NL
2. 第2轮得到FIN，栅栏中还剩DA|FG|L
3. 第3轮得到DFL，栅栏中还剩A|G|
4. 第4轮得到AG，栅栏被清空。

这个编码逻辑没啥漏洞，所以应当是正确思路。

根据这个思路可以写出py脚本直出flag。

dict = """the moon and sixpence
i did not see him again for nearlY a week. then he fetched me soon after seven one evening and took me out to dinner. he was dressed in the deepest mourning, and on his bowler was a broad black band. he had even a black border to his handkerchieF. his garb of woe suggested that he had lost in one catastrophe every relation he had in the world, even to cousins by marriage twice removed. his plumpness and his red, fat cheeks maDe his mourning not a little incongruous. it was cruel that his extreme unhappiness should have in it something of buffoonery.
he told me he had made up his mind to go Away, though not to italy, as i had suggested, but to holland.
"i'm starting tO-morrow. this is perhaps the last time we shall ever meet."
I made an appropriate rejoinder, and he smiled wanly.
"i haven't been home for five years. i think i'd Forgotten it all; i seemed to have come so far away from my father's house that i was shy at the idea of revisiting it; but now i feel it's my only refuGe."
he was sore and bruised, and his thoughts went back to the tenderness of his mother's love. the ridicUle he had endured for years seemed now to weigh him down, and the final blow of blanche's treachery had robbed him of the resiliency which had made him take it so gaily. he could no longer laugh with those who laughed at him. he was an outcast. he told me of his childhood in the tidy brick house, aNd of his mother's passionate orderliness. her kitchen was a miracle of clean brightness. everything was always in its place, and no where could you see a speck of dust. cleanliness, indeed, was a mania with her. i saw a neat little old woman, with cheeks like apples, toiling away from morning to night, through the long years, to keep her house trim and spruce. his father was a spare old man, his hands gnarled after the work of a lifetime, silent and upright; in the evening he read the paper aLoud, while his wife and daughter (now married to the captain of a fishing smack), unwilling to lose a moment, bent over their sewing. nothing ever happened in that little town, left behind by the advance of civilisation, and one year followed the next till death came, like a friend, to give rest to those who had laboured so diligently.
"""
enc = ""
for i in dict:
    if ord(i) in range(ord('A'), ord('Z') + 1):
        enc = enc + i
print(enc)
flag = ""
fenceN = 3
fence = []
baseLen = len(enc) // fenceN
more = len(enc) - baseLen * 3
for i in range(0,fenceN):
    if more > 0:
        fence.append(enc[:baseLen + 1])
        enc = enc[baseLen + 1:]
        more -= 1
    else:
        fence.append(enc[:baseLen])
        enc = enc[baseLen:]
while fence[0] != "":
    for i in range(0, fenceN):
        if len(fence[i]) == 0:
            break
        flag += fence[i][0]
        fence[i] = fence[i][1:]
flag = "flag{"+flag.lower()+"}"
print(flag)

flag

flag{youfindflag}